jazzband / django-invitations

Generic invitations app for Django
GNU General Public License v3.0
567 stars 166 forks source link

Add an example of using the package without `allauth` to the documentation #239

Open ivanov17 opened 10 months ago

ivanov17 commented 10 months ago

Hello,

I want to use django-invitations package to allow current website users to invite new ones. But at the same time, I want to allow access to the registration form only to those visitors who follow the invitation link. Other visitors (registered or unregistered) should not have access to the registration form page. In short, it should be something like a private club.

The first thing that comes to mind is to use Django sessions for this. But it looks like django-invitations does not create any session variable when accepting an invitation unless the adapter for django-allauth is used.

I think sending a session variable with a known name when the corresponding settings variable is set or even by default could be a very useful feature for cases like mine.

Or maybe there is a more obvious solution to this problem?

Thank you.

Flimm commented 5 months ago

You can do this with the setting INVITATIONS_INVITATION_ONLY, which depends on django-allauth. Are you saying that you need a solution that works without allauth?

ivanov17 commented 5 months ago

Sorry, I solved this issue but forgot to write about it. Yes, I needed a solution that works without the allauth package.

A session variable named account_verified_email is created when the invitation is accepted:

https://github.com/jazzband/django-invitations/blob/59453429e7d60e349cd77c4b17b3331d2ba0ce7d/invitations/views.py#L195

https://github.com/jazzband/django-invitations/blob/59453429e7d60e349cd77c4b17b3331d2ba0ce7d/invitations/adapters.py#L13-L15

So, there is no dependency on adapter provided by allauth. And I can use the following method to check the variable:

https://github.com/jazzband/django-invitations/blob/59453429e7d60e349cd77c4b17b3331d2ba0ce7d/invitations/adapters.py#L71-L81

Before this I also check that the user is not authenticated and registration is allowed. If the checks fail, I simply redirect the user to the login page.

So, there is no problem, and we can close this topic. But I think it would be useful to somehow reflect this in the documentation.